Re: Can we copy trust?

2008-06-03 Thread Anne Lynn Wheeler
Bill Frantz wrote: really used for strangers. For people we know, recognition and memory are more compelling ways of trusting. We can use this recognition and memory in the online world as well. SSH automatically recognizes previously used hosts. Programs such as the Pet Names

Re: Can we copy trust?

2008-06-03 Thread Ben Laurie
Ed Gerck wrote: Ben Laurie wrote: But doesn't that prove the point? The trust that you consequently place in the web server because of the certificate _cannot_ be copied to another webserver. That other webserver has to go out and buy its own copy, with its own domain name it it. A copy is

Re: Fwd: Protection mail at rest

2008-06-03 Thread Adam Aviv
I agree with you, that this is not nearly fast enough. However, this is 10 times faster then our original results, where we were searching 100 emails in about the same amount of time. With production code, some more optimization, esp. client side optimizations (i.e. message caching when

Re: Can we copy trust?

2008-06-03 Thread Bill Soley
[Moderator's note: Please do not top post. --Perry] I am thinking that trust is a relationship. A trusts B. So if you start with A trusts B and you do some operation that results in C trusts B then you have not copied anything because A trusts B is not equal to C trusts B. You can't

Re: Can we copy trust?

2008-06-03 Thread Ed Gerck
Bill Soley wrote: I am thinking that trust is a relationship. A trusts B. So if you start with A trusts B and you do some operation that results in C trusts B then you have not copied anything because A trusts B is not equal to C trusts B. You can't call that operation a copy. Trust is

Re: Can we copy trust?

2008-06-03 Thread IanG
Ed Gerck wrote: Bill Frantz wrote: [EMAIL PROTECTED] (Ed Gerck) on Monday, June 2, 2008 wrote: To trust something, you need to receive information from sources OTHER than the source you want to trust, and from as many other sources as necessary according to the extent of the trust you want.

Re: Can we copy trust?

2008-06-03 Thread [EMAIL PROTECTED]
On Mon, Jun 2, 2008 at 12:37 PM, Ed Gerck [EMAIL PROTECTED] wrote: In the essay Better Than Free, Kevin Kelly debates which concepts hold value online, and how to monetize those values. See www.kk.org/thetechnium/archives/2008/01/better_than_fre.php Kelly's point can be very useful: *When

Re: The perils of security tools

2008-06-03 Thread Philipp Gühring
Hi, It is not an implementaion issue but a requirement of the C standard. To avoid buffering use setvbuf (fp, NULL, _IONBF, 0); right after the fopen. Ah! Thanks a lot! Ok, I think that should be written into the man-pages of /dev/random and fgetc/fread and other related howtos. Best

Re: Fwd: Protection mail at rest

2008-06-03 Thread Greg Black
On 2008-06-02, Adam Aviv wrote: I recently implemented SSARES directly in python and also added parallelism to the searching. We can now search the a large inbox (1000+) messages in about 2-4 minutes. Not to rain on your parade, but 1,000 messages is *not* a large inbox and 2 to 4 minutes is

Re: Fwd: Protection mail at rest

2008-06-03 Thread Nate Lawson
Greg Black wrote: On 2008-06-02, Adam Aviv wrote: I recently implemented SSARES directly in python and also added parallelism to the searching. We can now search the a large inbox (1000+) messages in about 2-4 minutes. Not to rain on your parade, but 1,000 messages is *not* a large inbox and

Re: Fwd: Protection mail at rest

2008-06-03 Thread Adam Aviv
[Moderator's note: Please don't top post. --Perry] Depending on the level of protection you want, you could just add a script to your .forward to encrypt your email before delivery using PGP/GPG. However, this will leave the headers in the clear, so you will likely want to create an entirely new

Re: Can we copy trust?

2008-06-03 Thread Ed Gerck
Ben Laurie wrote: Obviously. Clearly I am talking about a server in a different domain. And we (Kelly and I) were talking about copying trust, where a copy is (as usual) a reproduction, a replication of an original. If you are copying trust from a domain, as represented by a SSL cert signed

Re: Can we copy trust?

2008-06-03 Thread Ed Gerck
IanG wrote: Ed Gerck wrote: When you look at trust in various contexts, you will still find the need to receive information from sources OTHER than the source you want to trust. You may use these channels under different names, such as memory which is a special type of output that serves as

Re: Can we copy trust?

2008-06-03 Thread Ed Gerck
[EMAIL PROTECTED] wrote: You don't have to trust the target site's self assertions about its own identity because you trust the root to only validate for sites that are what they claim to be. From the viewpoint of the user (which is the viewpoint used by Kelly), we see that trust can be

$20 bounty for errors in _Disappearing Cryptography_

2008-06-03 Thread Peter Wayner
I'm working on the third edition of _Disappearing Cryptography_ right now. If anyone knows of any technical errors in the second edition, I'm willing to pay $20 for the first person to report each technical error. The bounty can't apply to grammatical errors because of the complexity

Re: Can we copy trust?

2008-06-03 Thread [EMAIL PROTECTED]
On Tue, Jun 3, 2008 at 1:05 PM, Ed Gerck [EMAIL PROTECTED] wrote: [EMAIL PROTECTED] wrote: We see that the trust relationship represented by that SSL cert can be copied without any loss, as many times as you wish My understanding is that an SSL certificate is only a method to carry the

ADMIN: end of Can we copy trust discussion

2008-06-03 Thread Perry E. Metzger
I don't think anything new is being said in the Can we copy trust discussion, so I'm calling a halt to it. Perry -- Perry E. Metzger[EMAIL PROTECTED] - The Cryptography Mailing List Unsubscribe by sending

fyi: Traitor Tracing for Anonymous Attack in AACS Content Protection

2008-06-03 Thread ' =JeffH '
From:Adam Barth [EMAIL PROTECTED] Subject: TOMORROW 3 Jun - Hongxia Jin - Traitor Tracing for Anonymous Attack in AACS Content Protection To: [EMAIL PROTECTED] Date:Mon, 02 Jun 2008 18:48:48 -0700 Title: Traitor Tracing for Anonymous Attack in AACS Content Protection

ADMIN: What is top posting, and why should you avoid it?

2008-06-03 Thread Perry E. Metzger
A3: Please. Q3: Should I avoid top posting on this mailing list? A2: Because, by reversing the order of a conversation, it leaves the reader without much context, and makes them read a message in an unnatural order. Q2: Why is top posting irritating? A1: It is the practice of putting

Re: Protection mail at rest

2008-06-03 Thread Eric Cronin
On Jun 3, 2008, at 11:51 AM, Adam Aviv wrote: Depending on the level of protection you want, you could just add a script to your .forward to encrypt your email before delivery using PGP/GPG. However, this will leave the headers in the clear, so you will likely want to create an entirely new

Re: Can we copy trust?

2008-06-03 Thread Dave Howe
Ben Laurie wrote: Ed Gerck wrote: Ben Laurie wrote: But doesn't that prove the point? The trust that you consequently place in the web server because of the certificate _cannot_ be copied to another webserver. That other webserver has to go out and buy its own copy, with its own domain name